Rows picked one by one are undone only by who picked them, on the admin fleet route too

Follow-up to #790 from steward-reviewer-2's review. #790 merged at its approved head before this fix arrived.

The gap: the admin fleet route (POST /api/v1/fleet/ops/:id/undo) still let a site admin undo another person's bulk close or replan on their asks.

The fix (undoFleetOp, src/actions/fleet.ts): someone other than the actor gets not_found when the operation's verb is personal (dismiss), or when its rows were named one by one (applyFleetIds, the asks' bulk actions), whose query is not a fleet query. A site admin can still undo another person's query-based fleet operation, as before.

Test (asks-bulk.test.ts): bob, made a site admin and holding an admin token, gets 404 undoing alice's asks close through the fleet route, and alice's own undo still works. The fleet-ops tests pass unchanged. Typecheck is clean. reserved-names, studio, shards, check-list and hollow pass.

🤖 Generated with Claude Code

Rows picked one by one are undone only by who picked them, on the admin fleet route too #816

Keyboard shortcuts